Asterisk: The Definitive Guide, 5th Edition

Chapter 4. Certificates for Endpoint Security

We only need to be lucky once. You need to be lucky every time.

The IRA to Margaret Thatcher, after a failed assassination attempt

If you really want to do something, you’ll find a way. If you don’t, you’ll find an excuse.

Jim Rohn

The Inconvenience of Security

VoIP security can be regarded as two separate (but interconnected) challenges:

• Securing a system against toll fraud (which is generally the goal of SIP-based intrusion attempts)

• Securing a system against call interception (which relates to privacy, as well as improving toll fraud defenses)

There are of course many other aspects to the security of your system, but most of those are general security concepts, not specific to VoIP.

In this chapter we will focus on an area of security that is too often overlooked, namely the generation and application of certificates and keys in order to secure communication between endpoints and your system. In SIP communications, encryption is optional (and, unfortunately, not used most of the time). In WebRTC, it is required.

This chapter should by no means be considered the final word on securing your Asterisk system; there will be more covered in Chapter 22. We do hope, however, that it will provide you with a solid foundation on which to build a secure solution.

Securing SIP

If you build any sort of server that is exposed to the internet, and wait for a few short hours after powering it up, you will notice that the system will have already attracted probes ...